Heap-based Buffer Underflow in Vim Command Line Text Editor
CVE-2026-28419

5.3MEDIUM

Key Information:

Vendor

Vim

Status
Vim
Vendor
CVE Published:
27 February 2026

What is CVE-2026-28419?

A heap-based buffer underflow vulnerability is present in the Vim command line text editor, specifically found in its Emacs-style tags file parsing logic. When handling a malformed tags file, particularly one that includes a delimiter at the start of a line, Vim attempts to access memory that precedes the allocated buffer. This flaw can potentially lead to unpredictable behavior and expose sensitive information. The issue has been addressed in version 9.2.0075, which users are encouraged to upgrade to in order to mitigate the risk.

Affected Version(s)

vim < 9.2.0075

References

https://github.com/vim/vim/security/advisories/GHSA-xcc8-...
x_refsource_CONFIRM
https://github.com/vim/vim/commit/9b7dfa2948c9e1e5e32a5812
x_refsource_MISC
https://github.com/vim/vim/releases/tag/v9.2.0075
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.